In the Claims : 

Please amend Claims 1, 2, 9, 10, 13, 17, and 26 as indicated below. The 
status of all pending claims is as follows: 

1. (Currently Amended) An unauthorized access prevention system, 

including: 

a traffic recording unit recording information on traffic that flows into a 
user's communication network: 

a search unit searching the flowing-in path of unauthorized access , which is 
transmitted from a transmitter and is included in the traffic, t o services disclosed from a 
user's communication network; 

a determination unit determining a place to implement a countermeasure for 
protecting the services from the unauthorized access based on thea resuh of the search; 
and 

a notification unit notifying, according to a thea determination that the 
countermeasure is implemented in thea flow source that makes the unauthorized access 
flow into the user's communication network, the determination of the place to implement 
the countermeasure to the flow source. 

2 . (Currently Amended) A recording medium in whicha program that 
directs a computer to implement a countermeasure against unauthorized access is 
recorded and in which the program can be read by the computer, and the program directs 
the computer to perform the following processes by being executed by the computer: 
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a detection process of detecting unauthorized access transmitted from 
a transmitter to die-services disclosed from a user's communication network; and 

when the detection of the unauthorized access is notified, performs the 
following process: 

a search process of searching the flowing-in path of the unauthorized access 
to the services disclosed from the user's communication network; 

a determination process of determining th^ place to implement 
countermeasure for protecting the services from the unauthorized access based on thea 
result of the search; and 

a notification process of notifying, according to athea determination that the 
countermeasure is implemented in thea flow source that makes the unauthorized access 
flow into the user's communication network, the determination of the place to implement 
the countermeasure to the flow source. 

3-4. (Cancelled) 

5 . (Original) The recording medium according to claim 2, wherein 
the process of searching the flowing-in path is performed by the computer based on the 
monitoring information on the traffic transmitted by a user's communication network and 
the unauthorized access information indicating the contents of the unauthorized access. 
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6. (Original) The recording medium according to claim 5, wherein 
the monitoring information includes at least the position information on an edge router 
arranged on the border between the user's communication network and the 
communication network adjacent to the user's communication network and the 
monitoring information on the traffic that flows into the user's communication network 
via the edge router. 

7. (Previously Presented) The recording medium according to 
claim 2, wherein the notification process makes the computer execute a process of 
notifying the determination to the flow source after mutual attestation is conducted with 
the flow source of the unauthorized access, 

8 . (Original) The recording medium according to claim 2, wherein 
the process of notifying the determination to the flow source after information on a 
security policy for the operation of each network is exchanged with the flow source that 
transmits the unauthorized access is performed by the computer. 

9. (Currently Amended) The recording medium according to 
claim 8, wherein information on a security policy is the information indicating the time 
required ti n until the countermeasure against the unauthorized access is cancelled after the 
unauthorized access is not detected any more. 
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10. (Currently Amended) The recording medium according to 
claim 9, wherein when the time indicated by the information on the security policy differs 
between the user' communication network and the flow source, a shorter time of the two 
is used as the time required ti n until the countermeasure against unauthorized access is 
cancelled after the unauthorized access is not detected any more. 

1 1 . (Original) The recording medium according to claim 10, wherein 
the process of notifying the flow source of the determination and the information 
indicating the time required till the countermeasure against the unauthorized access is 
cancelled after the unauthorized access is not detected any more is performed by the 
computer. 

12. (Original) The recording medium according to claim 2, wherein 
the process of notifying the flow source of the unauthorized access of the determination 
using the communication path that differs from the flowing-in path of the unauthorized 
access is performed by the computer. 

1 3 . (Currently Amended) A recording medium in which a program 
that directs a computer to implement a countermeasure against unauthorized access is 
recorded and in which the program can be read by the computer, and the program directs 
the computer to perform the following processes by being executed by the computer: 

a detection process of detecting thean unauthorized access transmitted from 
a transmitter to die-services disclosed from a user's communication network; and 

5 



when the detection of the unauthorized access is notified, performs the 
following process: 

a search process of searching the flowing-in path of the unauthorized access 
to the services disclosed from the user's communication network; 

a determination process of determining the place to implement ^a 
countermeasure for protecting the services from the unauthorized access based on thea 
result of the search; and 

a notification process forjudging whether, when it is determined that the 
countermeasure is implemented in *ea flow source that makes the unauthorized access 
flow into the user's communication network, the determination is notified to the flow 
source, wherein 

by having the program executed by the computer; 

the unauthorized access countermeasure implementation control process 
that has the coimtermeasure for protecting the services from the unauthorized access 
implemented in the flow source when it is judged that the determination will not be 
notified to the flow source based on the above notification process is further performed by 
the computer. 

14. (Previously Presented) The recording medium according to 
claim 13, wherein the judgement is made based on judgement information on the flow 
source that is given in advance. 
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1 5 . (Original) The recording medium according to claim 2, wherein 
by having the program executed by the computer; 

the imauthorized access countermeasure implementation control process 
that has the countermeasure for protecting the services from the unauthorized access 
implemented in the user's communication network based on the determination that said 
countermeasure is implemented in the user' s communication network is performed by the 
computer. 

16. (Original) The recording medium according to claim 1 5, wherein 
the process of implementing the countermeasure in the POP (point of presence) edge 
router to which the flow source of the unauthorized access is connected is performed by 
the computer. 

17. (Currently Amended) The recording medium according to 
claim 16, wherein the process of identifying the POP edge router to which the transmitter 
that transmits the unauthorized acces s is connected based on the information obtained 
from the operation management system that manages the operation of the user's 
communication network is further performed by the computer. 

1 8 . (Original) The recording medium according to claim 1 5 , wherein 
by having the program executed by the computer; 

the process of obtaining a notification of the determination that 
unauthorized access to the services disclosed from a communication network different 
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from the user's communication network is made to flow into said other communication 
network is further performed by the computer; and 

the process of implementing the countermeasure for protecting the services 
disclosed from said other communication network from the unauthorized access related to 
the notification in the user' s communication network when the notification is obtained by 
the notification obtaining process is performed by the computer. 

1 9. (Original) The recording medium according to claim 15, wherein 
the coimtermeasure implemented by the unauthorized access countermeasure 
implementation control process is cancelled after the unauthorized access is not detected 
any more and a preset time passes. 

20. (Previously Presented) The recording medium according to 
claim 19, wherein the preset time is set based on the security policy on the network 
operation of both the user's communication network and the other commimication 
network. 

21. (Original) The recording medium according to claim 20, wherein 
when the times set between the user's communication network and the other 
communication network based on the security policy on the network operation of both 

networks differ between both networks, the countermeasure is cancelled after the 
unauthorized access is not detected any more and a shorter time of the two passes. 
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22. (Original) The recording medium according to claim 2, wherein 
by having the program executed by the computer; 

the process of obtaining a notification of the determination that 
unauthorized access to the services disclosed from a communication network different 
from the user's communication network is made to flow into said other communication 
network is performed by the computer; 

the process of searching the flowing-in path of the unauthorized access 
related to the notification in the user's communication network when the notification is 
obtained by the notification obtaining process is performed by the computer; 

the process of determining the place to implement the countermeasure for 
protecting the services disclosed from said other communication network from the 
unauthorized access related to the notification based on the result of the search when the 
notification is obtained by the notification obtaining process is performed by the 
computer; and 

the process of notifying, according to a determination that the 
countermeasure is implemented in the flow source that makes the unauthorized access 
related to the notification flow into the user's communication network when the 
notification is obtained by the notification obtaining process, the determination to the flow 
source is performed by the computer. 

23 . (Original) The recording medium according to claim 22, wherein 
by having the program executed by the computer; 

the unauthorized access countermeasure implementation control process 
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that has the countermeasure for protecting the services disclosed from the user's 
communication network or the other communication network from the unauthorized 
access related to the notification implemented in the communication network of the 
notification source of the notification when the notification obtained by said notification 
obtaining process is the same as that obtained in the past is further performed by the 
computer. 

24. (Original) The recording medium according to claim 23, wherein 
the process of notifying the information that uniquely identifies the unauthorized access 
related to the notification when the determination is notified is performed by the 
computer. 

25. (Original) The recording medium according to claim 2, wherein 
by having the program executed by the computer; 

the process of recording the history of the notification is further performed 
by the computer. 

26. (Currently Amended) An unauthorized access prevention 
method, including: 

searching the flowing-in path of unauthorized access transmitted from a 
transmitter to the services disclosed from the user's communication network; 

determining thea place to implement thea countermeasure for protecting the 
services from the unauthorized access based on feea resuh of the search; and 
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notifying, according to athea determination that the countermeasure is 
implemented in thea flow sovirce that makes the unauthorized access flow into the user' s 
commimication network, the determination of the place to implement the countermeasure 
of the place to implement the countermeasure t o the flow source. 

27. (Cancelled) 
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